What is a common mistake when working with OAuth 2.0?

A common mistake with OAuth 2.0 is treating OAuth access tokens as proof of user identity without considering token purpose or OpenID Connect semantics can lead to incorrect authentication decisions. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.